bigops-offers @35.6.8

Summary

bigops-offers@35.6.8 executes a binary dropper at require time. index.js loads./_init on import; _init.js assembles C2 hostnames from split string arrays (workers.dev subdomains oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) and fetches a platform-specific binary via https.get. A DNS TXT-record fallback assembles base64 payload chunks from c.dl.wel1.ru and 0..N.dl.wel1.ru (sdk/ext/pkg/net subdomains). The retrieved bytes are written to a disguised path (dotnet_diag_<rand>.exe on Windows,.cache_<rand> on Unix), chmod 0o755, and spawned detached via /bin/sh or cmd. A.analytics_state lock file and DISABLE_TELEMETRY/DO_NOT_TRACK env checks provide a telemetry cover story. Destinations, filenames, and delivery channels are string-split to evade static detection.

Source: amazon-inspector (422359e6c8044efa7c3873ff0859acb1480ea95413cbfb8829dc4c674de6f8d5)